CVE-2026-57862

Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.2.53

Description Authenticated users can bypass server-side request forgery (SSRF) protections by using hexadecimal IP address notation in user-controlled URLs. Through the web link creation feature, attackers can submit hexadecimal-encoded internal IP addresses, leading cURL to connect to internal network resources, including localhost services, cloud instance metadata services, and RFC1918 addresses. This occurs because the isPrivateURL() function in app/Core/Http/Client.php incorrectly validates the input as safe since FILTER VALIDATE IP rejects non-dotted-decimal notation.

Recommendations Update Kanboard to version 1.2.53 or later.